Yahoo quickly fixes Flickr SQL injection, remote code execution flaws

Share this article:

A security researcher identified flaws in popular photo sharing service Flickr that could result in SQL injection and remote code execution, but Yahoo acknowledged and quickly patched the problems.

The SQL injection bugs open the door for remote code execution, Ibrahim Raafat wrote in a Saturday post, explaining he was ultimately able to obtain the MYSQL root password and gain access to sensitive information contained within the Flickr database. 

Raafat originally launched Flickr to check if a vulnerability he previously reported to Yahoo had been patched, but soon discovered two Blind SQL Injection vulnerabilities and a Direct SQL Injection flaw in the Flickr Photo Books feature.

The researcher reported the vulnerabilities to Yahoo and the internet corporation patched the problems within six hours, Raafat wrote.

Share this article:

Sign up to our newsletters

More in News

New backdoor 'Baccamun' spreads through ActiveX exploit

Symantec researchers revealed that the backdoor is dropped after attackers exploit a Windows ActiveX vulnerability.

Outdated browsers put U.K. users at risk of malware

A blog post on Check and Secure website said 70 percent of U.K. users haven't fully updated their internet browsers

Survey: 53 percent change privileged logins quarterly

A Lieberman Software survey highlights the issue or poor password management, even among security pros.